Dave's ruling on TASK-3345 #1: a missing `resource` parameter is defaulted
to /mcp's canonical audience, which lets a client registered through DCR
replay a token cross-server. Phase 2, a release later, refuses such
requests with invalid_target. Phase 1 measures who that would break, and
changes no behaviour.
- translateResourceToAudience now reports whether it DEFAULTED a missing
resource. The authorize, decide and token handlers then call
noteResourceMissing.
- noteResourceMissing logs one WARN line naming the endpoint, client_id
and the client's registered name, and increments the new
pad_oauth_resource_missing_total{endpoint}. The label is the endpoint
only, so cardinality stays bounded; the client is in the log.
- Legs: with resource, nothing is counted; without, the request is still
served and counted at authorize, decide and token. Mutants L1-L5 killed.
Claude-Session: https://claude.ai/code/session_01H63zaWhkb5pAafx2WGjrVC
xarmian